EN PT-BR
← Voltar ao feed
high automotive

ForgeRock WAF bypass and default Felix console credentials give RCE on two automakers' identity servers and remote car control

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 03:13 · coletado há 1 hora

Researchers Shubham Shah and Sam Curry chained a path-parsing bypass of a ForgeRock WAF with the default password of an Apache Felix web console to reach code execution on production OpenIDM servers used by two unnamed automakers. From there they could take over customer accounts, mint mobile app OAuth tokens, and reach vehicle data and remote commands such as unlocking doors and starting engines. The first stage needed only the public edge and the documented default password, which is why the article calls it critical. Still, the console was a configuration weakness, the path mismatch is an interaction between components, and no CVE or vendor advisory was found in the sources opened. Both automakers reportedly fixed the chain about two hours after the report and rotated the affected credentials, and none of the sources opened report malicious exploitation, so the rating is high.

Entenda a falha

A vulnerabilidade

This is a chain of weaknesses, not a single CVE (none was found). It affects ForgeRock Access Management and OpenIDM deployments at two unnamed automakers, plus the Apache Felix Web Console (framework 7.0.1) that OpenIDM runs on. A WAF at the edge blocked the admin paths, but a specially formatted URL got past it. The Felix console still accepted its documented default password, so an attacker who could reach the public edge needed no other access. From there the researchers got code execution inside the OpenIDM process, took over customer accounts and reached vehicle data and remote commands such as unlock and engine start. No affected or fixed versions are given; both automakers fixed their deployments by closing the chain and rotating credentials.

Como funciona

The mobile apps log in through ForgeRock Access Management, and customer records live in OpenIDM, which runs as OSGi bundles inside Apache Felix. The Felix Web Console sits under /system/console, with a bundles plugin and ConfigMgr for changing live configuration. A request to those paths is blocked by the WAF. A request built with encoded slashes, dot segments and semicolon parameters looks like a static-asset request to the WAF. Jetty then decodes and normalises the path before choosing the servlet, and Felix picks its plugin from the resulting path. The console accepts the default login, and OpenIDM's scheduler, which supports inline Groovy, can then be configured to run code in the identity process. With that access, valid sessions for customers can be exchanged for mobile app OAuth tokens that control the vehicle.

Por que é vulnerável

There are two root causes. First, the WAF, the Jetty servlet container and the applications parse the same URL differently, so the WAF's path rules do not match what the backend ends up serving. Second, the Felix Web Console was exposed on production nodes with the default admin:admin credential unchanged, a configuration weakness. The researchers also note that secrets such as an administrative credential pair were available in the process environment, which widened the impact once code ran. The fix described is to remove or restrict the console, replace default passwords and normalise URLs consistently across layers. No vendor patch is mentioned.

Onde está

The Apache Felix Web Console at /system/console (bundles plugin and ConfigMgr) and OpenIDM's scheduler with inline Groovy, reached through the edge WAF's static-asset path handling; no file, function or commit is named.

Como foi descoberta

Shubham Shah and Sam Curry found the chain during authorized testing. They reverse-engineered both automakers' Android apps, traced the login requests to ForgeRock, and then found the OpenIDM and Felix admin endpoints behind the WAF. They reported it to the automakers' product security teams, and both fixed it about two hours after the report and rotated credentials. The researchers tested the full chain only with US accounts and vehicles. The articles report no malicious exploitation, and no CVE or vendor advisory was found.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

The researchers demonstrated the full chain working on live production servers of both automakers, from the WAF bypass through code execution to vehicle commands. That makes it a working exploit chain, but the articles do not say any exploit code or tool was released, so it is treated as private. The automakers have fixed their deployments. Other deployments that expose the Felix console with default credentials behind a similar edge setup should still be checked urgently.

Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 04:19.

Detalhes técnicos

  • Identity stack: Both automakers' mobile apps authenticate through ForgeRock Access Management and keep customer records in OpenIDM, and the two login flows were nearly identical (samcurry.net).
  • WAF bypass: The edge blocked direct requests to the OpenIDM and Felix admin paths and banned the requesting IP after repeated attempts. A request under a static-asset prefix, built from encoded slashes, dot segments and semicolon path parameters, passed the edge. Jetty normalised the path before servlet selection, Felix then chose its bundles plugin, and OpenIDM's CREST layer kept an extra path segment, so each component parsed the same URL differently (samcurry.net).
  • Default credentials: The Felix console accepted admin:admin and returned an inventory of 361 bundles, 343 of them active, on Felix framework 7.0.1 (samcurry.net).
  • Code execution: Through ConfigMgr the researchers created an OpenIDM scheduler job with inline Groovy that installed an OSGi servlet through the Felix ShellService, and that servlet ran a test command inside the identity process (samcurry.net).
  • Account takeover and vehicle access: Using an administrative credential pair found in the process environment, they queried and modified managed-user records, changed a test account's email and password, completed the login with a code read from an attacker-controlled inbox, and exchanged the session for mobileappsdkclient OAuth tokens. They then listed the account's VINs and sent commands such as doors-unlock (samcurry.net).

Remediação

  • Both automakers rotated the exposed credentials and fixed the chain (samcurry.net). No ForgeRock or Ping Identity advisory, patched release or CVE was found in the sources opened.
  • Remove the Felix Web Console from production nodes or restrict it, and replace every default password, as ForgeRock's hardening guidance recommends (samcurry.net).
  • Normalise URLs the same way across the WAF, the servlet container and the application, and deny encoded slashes, dot segments and semicolon parameters on administrative prefixes.
  • Review OpenIDM scheduler and ConfigMgr factory entries for unexpected inline Groovy jobs, and check the Felix bundle inventory for unknown bundles.
  • Keep administrative APIs on internal networks, and do not ship staging or admin credentials inside client applications.

Relatos divergentes

  • The article says both automakers fixed the chain about two hours after disclosure. The researchers' write-up says they fixed it within about two hours after the researchers reported it (samcurry.net). The researchers' account is the more precise timeline.
  • The article's headline frames the activity as hackers exploiting the flaw. The researchers' write-up describes authorized testing that was reported to the automakers' product security teams (samcurry.net).

Linha do tempo

  1. gbhackers.com ↗ · pub. 10/11/2026 03:13 · coletado 10/11 04:00 primeiro registro

    ForgeRock WAF bypass and default Felix console credentials give RCE on two automakers' identity servers and remote car control

    ler a análise desta fonte

    Researchers Shubham Shah and Sam Curry chained a path-parsing bypass of a ForgeRock WAF with the default password of an Apache Felix web console to reach code execution on production OpenIDM servers used by two unnamed automakers. From there they could take over customer accounts, mint mobile app OAuth tokens, and reach vehicle data and remote commands such as unlocking doors and starting engines. The first stage needed only the public edge and the documented default password, which is why the article calls it critical. Still, the console was a configuration weakness, the path mismatch is an interaction between components, and no CVE or vendor advisory was found in the sources opened. Both automakers reportedly fixed the chain about two hours after the report and rotated the affected credentials, and none of the sources opened report malicious exploitation, so the rating is high.

    Technical Details

    • Identity stack: Both automakers' mobile apps authenticate through ForgeRock Access Management and keep customer records in OpenIDM, and the two login flows were nearly identical (samcurry.net).
    • WAF bypass: The edge blocked direct requests to the OpenIDM and Felix admin paths and banned the requesting IP after repeated attempts. A request under a static-asset prefix, built from encoded slashes, dot segments and semicolon path parameters, passed the edge. Jetty normalised the path before servlet selection, Felix then chose its bundles plugin, and OpenIDM's CREST layer kept an extra path segment, so each component parsed the same URL differently (samcurry.net).
    • Default credentials: The Felix console accepted admin:admin and returned an inventory of 361 bundles, 343 of them active, on Felix framework 7.0.1 (samcurry.net).
    • Code execution: Through ConfigMgr the researchers created an OpenIDM scheduler job with inline Groovy that installed an OSGi servlet through the Felix ShellService, and that servlet ran a test command inside the identity process (samcurry.net).
    • Account takeover and vehicle access: Using an administrative credential pair found in the process environment, they queried and modified managed-user records, changed a test account's email and password, completed the login with a code read from an attacker-controlled inbox, and exchanged the session for mobileappsdkclient OAuth tokens. They then listed the account's VINs and sent commands such as doors-unlock (samcurry.net).

    Remediation

    • Both automakers rotated the exposed credentials and fixed the chain (samcurry.net). No ForgeRock or Ping Identity advisory, patched release or CVE was found in the sources opened.
    • Remove the Felix Web Console from production nodes or restrict it, and replace every default password, as ForgeRock's hardening guidance recommends (samcurry.net).
    • Normalise URLs the same way across the WAF, the servlet container and the application, and deny encoded slashes, dot segments and semicolon parameters on administrative prefixes.
    • Review OpenIDM scheduler and ConfigMgr factory entries for unexpected inline Groovy jobs, and check the Felix bundle inventory for unknown bundles.
    • Keep administrative APIs on internal networks, and do not ship staging or admin credentials inside client applications.

    Conflicting Reports

    • The article says both automakers fixed the chain about two hours after disclosure. The researchers' write-up says they fixed it within about two hours after the researchers reported it (samcurry.net). The researchers' account is the more precise timeline.
    • The article's headline frames the activity as hackers exploiting the flaw. The researchers' write-up describes authorized testing that was reported to the automakers' product security teams (samcurry.net).